Vulnerabilities

A flaw was found in the kernel. An unprivileged local user can exploit this vulnerability to execute arbitrary code within the kernel, which leads to a local privilege escalation (LPE). This allows the attacker to gain root privileges and take full control of the affected system.

Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper validation of user inputs lead to a reflective XSS vulnerability.

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.1 - Improper limitation of paths for save and download actions lead to path traversal vulnerabilities.

Rejected reason: This is a duplicate.

cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service.<br /> <br /> <br /> <br /> <br /> Because project creator contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.7.19 but may also affect other versions.

This vulnerability exists in CP PLUS EZ-P21 IP Camera due to an insecure debug feature enabled in the firmware.<br /> <br /> An attacker with physical access could exploit this vulnerability by placing arbitrary code on removable media and triggering their execution through the debug mechanism.<br /> <br /> <br /> <br /> Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code with elevated privileges on the targeted device.

This vulnerability exists in CP PLUS EZ-P21 IP Camera due to improper authentication of HTTP endpoints. A remote attacker could exploit this vulnerability by conducting brute-force attacks against HTTP endpoint on the targeted device.<br /> <br /> <br /> <br /> Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to live video snapshots from the targeted device.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: openvswitch: reject oversized nested action attrs<br /> <br /> Open vSwitch stores generated flow actions as nlattrs, whose nla_len<br /> field is u16. Commit a1e64addf3ff ("net: openvswitch: remove<br /> misbehaving actions length check") allowed the total sw_flow_actions<br /> stream to grow beyond 64 KiB, which is valid, but also removed the last<br /> guard preventing a generated nested action attribute from exceeding<br /> U16_MAX.<br /> <br /> An oversized generated container can thus be closed with a truncated<br /> nla_len. A later dump or teardown then walks a structurally different<br /> stream than the one that was validated. In particular, an oversized<br /> nested CLONE/CT action may cause subsequent bytes in the generated<br /> stream to be interpreted as independent actions.<br /> <br /> Keep the larger total-action-stream behavior, but make nested action<br /> close reject generated containers that do not fit in nla_len, and return<br /> the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and<br /> CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse<br /> construction order before discarding failed wrappers, so resources copied<br /> into the rejected tails are released before the wrappers are removed.<br /> <br /> Most failed outer wrappers are discarded by truncating actions_len after<br /> child resources have been released. CHECK_PKT_LEN also trims its parent<br /> after branch resources are gone. SET/TUNNEL close failures unwind their<br /> known tun_dst ownership directly, and SET_TO_MASKED has no external<br /> ownership and truncates on close failure.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}<br /> <br /> In do_action()&amp;#39;s UpdateRecordDataRoot (fslog.c:3489) and<br /> UpdateRecordDataAllocation (fslog.c:3697) cases, the memmove<br /> destination is `Add2Ptr(e, le16_to_cpu(e-&gt;view.data_off))`,<br /> where e-&gt;view.data_off comes from an on-disk NTFS_DE inside<br /> an INDEX_ROOT or INDEX_BUFFER. Neither case validates<br /> view.data_off + dlen against e-&gt;size; the existing<br /> check_if_index_root / check_if_alloc_index helpers walk the<br /> entry chain and validate the entry&amp;#39;s offset, but not its<br /> internal view fields.<br /> <br /> The neighbouring read sites (e.g., fs/ntfs3/index.c when<br /> iterating view entries) check view.data_off + view.data_size<br /> size. Apply the same bound at the two memmove sites.<br /> <br /> Reproduced under UML+KASAN on mainline 8d90b09e6741 via<br /> pr_warn-only probe instrumentation: with view.data_off forced<br /> to 0xFFFC, the memmove writes 32 bytes past the end of the<br /> NTFS_DE.<br /> <br /> This is similar in shape to Pavitra Jha&amp;#39;s 2026-05-02 patch<br /> "fs/ntfs3: prevent oob in case UpdateRecordDataRoot"<br /> () which<br /> proposes calling ntfs3_bad_de_range(); that helper does not<br /> exist in mainline. This patch uses inline checks.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fs/ntfs3: validate lcns_follow in log_replay conversion<br /> <br /> log_replay() converts DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY<br /> records when replaying version 0 restart tables.<br /> <br /> During this conversion, the memmove() length is derived directly from<br /> the on-disk lcns_follow field:<br /> <br /> memmove(&amp;dp-&gt;vcn, &amp;dp0-&gt;vcn_low,<br /> 2 * sizeof(u64) +<br /> le32_to_cpu(dp-&gt;lcns_follow) * sizeof(u64));<br /> <br /> check_rstbl() validates restart table structure, but does not constrain<br /> per-entry lcns_follow values relative to the entry size. A malformed<br /> filesystem image can provide an oversized lcns_follow value, causing<br /> the conversion memmove() to access memory beyond the bounds of the<br /> allocated restart table buffer.<br /> <br /> The same field is later used to bound iteration over page_lcns[],<br /> so validating lcns_follow during conversion also prevents downstream<br /> out-of-bounds access from the same malformed metadata.<br /> <br /> Compute the maximum valid lcns_follow from the already-validated<br /> restart table entry size and reject entries that exceed this bound.<br /> Reuse the existing t16/t32 scratch variables already declared in<br /> log_replay() to avoid introducing new declarations.<br /> <br /> [almaz.alexandrovich@paragon-software.com: fixed the conflicts]

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path<br /> <br /> In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected,<br /> nvmet_req_uninit() is called unconditionally. However, if the command<br /> arrived via the nvmet_tcp_handle_req_failure() path, nvmet_req_init()<br /> had returned false and percpu_ref_tryget_live() was never executed. The<br /> unconditional percpu_ref_put() inside nvmet_req_uninit() then causes a<br /> refcount underflow, leading to a WARNING in<br /> percpu_ref_switch_to_atomic_rcu, a use-after-free diagnostic, and<br /> eventually a permanent workqueue deadlock.<br /> <br /> Check cmd-&gt;flags &amp; NVMET_TCP_F_INIT_FAILED before calling<br /> nvmet_req_uninit(), matching the existing pattern in<br /> nvmet_tcp_execute_request().

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> nvmet-tcp: Fix potential UAF when ddgst mismatch<br /> <br /> Shivam Kumar found via vulnerability testing:<br /> When data digest is enabled on an NVMe/TCP connection and a digest<br /> mismatch occurs on a non-final H2C_DATA PDU during an R2T-based<br /> data transfer, the digest error handler in nvmet_tcp_try_recv_ddgst()<br /> calls nvmet_req_uninit() — which performs percpu_ref_put() on the<br /> submission queue — but does NOT mark the command as completed. It<br /> does not set cqe-&gt;status, does not modify rbytes_done, and does not<br /> clear any flag. When the subsequent fatal error triggers queue<br /> teardown, nvmet_tcp_uninit_data_in_cmds() iterates all commands,<br /> checks nvmet_tcp_need_data_in() for each one, and finds that the<br /> already-uninited command still appears to need data (because<br /> rbytes_done status == 0). It therefore calls<br /> nvmet_req_uninit() a second time on the same command — a double<br /> percpu_ref_put against a single percpu_ref_get.